Envoy/Prechecks #11
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Envoy/Prechecks | |
| permissions: | |
| contents: read | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Request | |
| types: | |
| - completed | |
| concurrency: | |
| group: >- | |
| ${{ ((github.event.workflow_run.head_branch == 'main' | |
| || startsWith(github.event.workflow_run.head_branch, 'release/v')) | |
| && github.event.repository.full_name == github.repository) | |
| && github.run_id | |
| || github.event.workflow_run.head_branch }}-${{ github.event.repository.full_name }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| env: | |
| CI_DEBUG: ${{ vars.CI_DEBUG }} | |
| jobs: | |
| load: | |
| secrets: | |
| app-key: ${{ secrets.ENVOY_CI_APP_KEY }} | |
| app-id: ${{ secrets.ENVOY_CI_APP_ID }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| pull-requests: read | |
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| uses: ./.github/workflows/_load.yml | |
| with: | |
| check-name: prechecks | |
| format: | |
| secrets: | |
| gcs-cache-key: ${{ secrets.GCS_CACHE_KEY }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| pull-requests: read | |
| name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }}) | |
| uses: ./.github/workflows/_precheck_format.yml | |
| if: ${{ fromJSON(needs.load.outputs.request).run.precheck-format }} | |
| needs: | |
| - load | |
| with: | |
| gcs-cache-bucket: ${{ vars.ENVOY_CACHE_BUCKET }} | |
| request: ${{ needs.load.outputs.request }} | |
| trusted: ${{ fromJSON(needs.load.outputs.trusted) }} | |
| deps: | |
| secrets: | |
| gcs-cache-key: ${{ secrets.GCS_CACHE_KEY }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| pull-requests: read | |
| name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }}) | |
| uses: ./.github/workflows/_precheck_deps.yml | |
| if: ${{ fromJSON(needs.load.outputs.request).run.precheck-deps }} | |
| needs: | |
| - load | |
| with: | |
| gcs-cache-bucket: ${{ vars.ENVOY_CACHE_BUCKET }} | |
| dependency-review: ${{ github.event_name == 'pull_request_target' && github.repository == 'envoyproxy/envoy' }} | |
| request: ${{ needs.load.outputs.request }} | |
| trusted: ${{ fromJSON(needs.load.outputs.trusted) }} | |
| publish: | |
| secrets: | |
| gcp-key: ${{ fromJSON(needs.load.outputs.trusted) && secrets.GCP_SERVICE_ACCOUNT_KEY_TRUSTED || secrets.GCP_SERVICE_ACCOUNT_KEY }} | |
| gcs-cache-key: ${{ secrets.GCS_CACHE_KEY }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| pull-requests: read | |
| name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }}) | |
| uses: ./.github/workflows/_precheck_publish.yml | |
| if: ${{ fromJSON(needs.load.outputs.request).run.precheck-publish }} | |
| needs: | |
| - load | |
| with: | |
| gcs-cache-bucket: ${{ vars.ENVOY_CACHE_BUCKET }} | |
| request: ${{ needs.load.outputs.request }} | |
| trusted: ${{ fromJSON(needs.load.outputs.trusted) }} | |
| request: | |
| secrets: | |
| app-id: ${{ secrets.ENVOY_CI_APP_ID }} | |
| app-key: ${{ secrets.ENVOY_CI_APP_KEY }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: read | |
| if: >- | |
| ${{ always() | |
| && github.event.workflow_run.conclusion == 'success' | |
| && (fromJSON(needs.load.outputs.request).run.precheck-format | |
| || fromJSON(needs.load.outputs.request).run.precheck-deps | |
| || fromJSON(needs.load.outputs.request).run.precheck-publish) }} | |
| needs: | |
| - load | |
| - format | |
| - deps | |
| - publish | |
| uses: ./.github/workflows/_finish.yml | |
| with: | |
| needs: ${{ toJSON(needs) }} |